Linux TCP UDP port mapping and DNS hijacking

The problem with port mapping under Linux is that it uses Linux as a gateway route to connect with ISPs and to Nat the company's intranet IP address into the IP provided by the ISP. Ensure that all hosts in the intranet can share a public IP to access the Internet. But doing so also poses the problem that we cannot access or manage our intranet servers in the Post office network. To solve this problem, on the Linux gateway server on the ISP-provided IP related ports through the Dnat way map to our intranet server open port, can be implemented in the external network management intranet server.

Scenario 1. The public network is 223.71.x.x, the intranet IP is 172.17.17.115, the management port is TCP 81. The workaround is as follows.

Iptables-t nat-a prerouting-d 223.71.x.x/32-p tcp--dport 81-j DNAT--to-destination 172.17.17.115:81

TCP port mappings are prefixed with the appropriate port number after the IP, but this is not required for UDP mapping.

Scenario 2. Public network ip223.71.x.x intranet IP is 172.16.2.253, the management port is UDP 1701. Here's how to fix it

Iptables-t nat-a prerouting-d 223.71.224.42/32-p UDP--dport 1701-j DNAT--to-destination 172.16.2.253

Scenario 3. This is a special application is to do DNS hijacking, the Intranet user interface eth1.616 DNS requests all Dnat to 114.114.114.114. The method is as follows.

Iptables-t nat-a prerouting-i eth1.616-p UDP--dport 53-j DNAT--to-destination 114.114.114.114

This article is from the "LIHONGWEIBJ" blog, make sure to keep this source http://lihongweibj.blog.51cto.com/6235038/1698031

Linux TCP UDP port mapping and DNS hijacking